Password Generator

Generating cryptographically secure passwords

This tool generates passwords using the browser's Web Crypto API (crypto.getRandomValues()), which provides cryptographically secure random numbers - not the weaker Math.random() that JavaScript provides by default. No passwords are stored or transmitted.

Password entropy is the measure of how unpredictable a randomly generated password is, expressed in bits. For a password drawn uniformly at random it is exactlyL × log₂(N), where L is the length and N the size of the character set. Each bit doubles the number of guesses an attacker must make, so the math is worth internalising:

• Lowercase only (N = 26) → 4.7 bits per character
• Lower + upper (N = 52) → 5.7 bits per character
• Alphanumeric (N = 62) → 5.95 bits per character
• All four types, this tool's full set (N = 88) → 6.46 bits per character

The consequence surprises people: length beats complexity. A 20-character lowercase password carries 94 bits, comfortably more than a 12-character password drawn from all four sets here (77.5 bits). Switching on symbols buys you about half a bit per character; adding four more characters buys you twenty-plus. This is also why entropy only applies to randomly generated strings - a human-chosen password like P@ssw0rd2024! scores in the eighties on the formula but appears in every cracking dictionary and falls in milliseconds.

What current guidance actually says

NIST SP 800-63B, the US federal digital identity standard, reversed a generation of received wisdom. It tells verifiers to allow at least 64 characters, to accept all printable ASCII plus Unicode and spaces, and explicitly not to impose composition rules ("must contain one uppercase and one symbol") or arbitrary periodic expiry - both of which push users toward predictable patterns likeSummer2024! and Summer2025!. What it does require is screening new passwords against lists of known-breached values, which is what services like Have I Been Pwned's k-anonymity API exist to do. The 2024 second public draft additionally recommends an 8-character minimum with 15 characters as the target.

Practical rules that follow from all of the above:

• Never reuse passwords - credential stuffing, where breached pairs are replayed across sites, is the single most successful attack in use
• Use a password manager - Bitwarden, 1Password, KeePassXC, or your browser's built-in vault; you memorise one long passphrase and it handles the rest
• Prefer phishing-resistant second factors - a passkey or hardware security key beats TOTP, and TOTP beats SMS, which is vulnerable to SIM swapping
• Go long before you go complex - 20 random characters beats any clever substitution scheme
• Avoid structure - keyboard walks (qwerty, 1qaz2wsx), leetspeak swaps, dates, and pet names are all in standard wordlists

The strength indicator maps entropy to four bands: under 36 bits is Weak(a commodity GPU rig testing billions of hashes per second clears this range quickly), 36–60 bits is Fair, 60–100 bits is Strong and adequate for everyday accounts, and above 100 bits is Very Strong - beyond the reach of any foreseeable brute-force effort. In practice the weak link is rarely the password itself but the site storing it, which is why unique passwords per service matter more than squeezing out extra bits.

Generation happens entirely in this browser tab. There is no network request in the code path, no analytics on the output, and no server-side log - the passwords exist only in page memory until you copy them, so save each one to your manager before closing the tab.